

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=&#34;auto&#34;>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/2.jpg">
  <link rel="icon" type="image/png" href="/img/2.jpg">
  <meta name="viewport"
        content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="description" content="">
  <meta name="author" content="K">
  <meta name="keywords" content="">
  <title>docker-日志管理 - K</title>

  <link  rel="stylesheet" href="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.staticfile.org/github-markdown-css/4.0.0/github-markdown.min.css" />
  <link  rel="stylesheet" href="/lib/hint/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.staticfile.org/highlight.js/10.0.0/styles/github-gist.min.css" />
    
  

  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_ba1fz6golrf.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_kmeydafke9r.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->


  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
<meta name="generator" content="Hexo 5.2.0"></head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand"
       href="/">&nbsp;<strong>かい</strong>&nbsp;</a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" data-toggle="modal" data-target="#modalSearch">&nbsp;<i
                class="iconfont icon-search"></i>&nbsp;</a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" href="javascript:">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner intro-2" id="background" parallax=true
         style="background: url('/img/1.jpg') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
          <div class="container page-header text-center fade-in-up">
            <span class="h2" id="subtitle">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2020-12-15 17:00" pubdate>
        2020年12月15日 下午
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      4.9k 字
    </span>
  

  
    
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      70
       分钟
    </span>
  

  
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid">
  <div class="row">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-md">
      <div class="container nopadding-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto" id="post">
            <!-- SEO header -->
            <h1 style="display: none">docker-日志管理</h1>
            
            <div class="markdown-body" id="post-body">
              <h2 id="docker-日志处理"><a href="#docker-日志处理" class="headerlink" title="docker 日志处理"></a>docker 日志处理</h2><ul>
<li>日志管理：logging driver</li>
<li>日志驱动：json-file </li>
<li>通过 docker info 查看上面这俩个东西</li>
</ul>
<h2 id="docker默认自带日志功能"><a href="#docker默认自带日志功能" class="headerlink" title="docker默认自带日志功能"></a>docker默认自带日志功能</h2><ul>
<li><p>对于一个运行的容器，docker会将日志发送到容器标准的输入输出设备</p>
<pre><code class="hljs angelscript"><span class="hljs-string">[root@localhost ~]</span># ll /dev/stdout
lrwxrwxrwx. <span class="hljs-number">1</span> root root <span class="hljs-number">15</span> <span class="hljs-number">12</span>月 <span class="hljs-number">16</span> <span class="hljs-number">21</span>:<span class="hljs-number">47</span> /dev/stdout -&gt; /proc/self/fd/<span class="hljs-number">1</span>
<span class="hljs-string">[root@localhost ~]</span># ll /dev/stderr
lrwxrwxrwx. <span class="hljs-number">1</span> root root <span class="hljs-number">15</span> <span class="hljs-number">12</span>月 <span class="hljs-number">16</span> <span class="hljs-number">21</span>:<span class="hljs-number">47</span> /dev/stderr -&gt; /proc/self/fd/<span class="hljs-number">2</span>
# 上面的两个设备，容器会默认把日志输出到里面
<span class="hljs-string">[root@localhost ~]</span># ll /dev/zero
crw-rw-rw-. <span class="hljs-number">1</span> root root <span class="hljs-number">1</span>, <span class="hljs-number">5</span> <span class="hljs-number">12</span>月 <span class="hljs-number">16</span> <span class="hljs-number">21</span>:<span class="hljs-number">47</span> /dev/zero
<span class="hljs-string">[root@localhost ~]</span># ll /dev/<span class="hljs-literal">null</span>
crw-rw-rw-. <span class="hljs-number">1</span> root root <span class="hljs-number">1</span>, <span class="hljs-number">3</span> <span class="hljs-number">12</span>月 <span class="hljs-number">16</span> <span class="hljs-number">21</span>:<span class="hljs-number">47</span> /dev/<span class="hljs-literal">null</span>
</code></pre>
<blockquote>
<p>查看容器的日志</p>
</blockquote>
<pre><code class="hljs pgsql">[root@localhost ~]# docker run -itd <span class="hljs-comment">--name web1 httpd</span>
<span class="hljs-number">1</span>d66f6cb4689852c41d4160a0ce4c830dec8791a2ea0b661f15d81696ea29147

[root@localhost ~]# docker logs web1
AH00558: httpd: Could <span class="hljs-keyword">not</span> reliably determine the <span class="hljs-keyword">server</span><span class="hljs-string">&#x27;s fully qualified domain name, using 172.17.0.2. Set the &#x27;</span>ServerNam<span class="hljs-string">e&#x27; directive globally to suppress this message</span>
<span class="hljs-string">AH00558: httpd: Could not reliably determine the server&#x27;</span>s fully qualified <span class="hljs-keyword">domain</span> <span class="hljs-type">name</span>, <span class="hljs-keyword">using</span> <span class="hljs-number">172.17</span><span class="hljs-number">.0</span><span class="hljs-number">.2</span>. <span class="hljs-keyword">Set</span> the <span class="hljs-string">&#x27;ServerName&#x27;</span> directive globally <span class="hljs-keyword">to</span> suppress this message
[Wed <span class="hljs-type">Dec</span> <span class="hljs-number">16</span> <span class="hljs-number">13</span>:<span class="hljs-number">50</span>:<span class="hljs-number">34.114666</span> <span class="hljs-number">2020</span>] [mpm_event:<span class="hljs-keyword">notice</span>] [pid <span class="hljs-number">1</span>:tid <span class="hljs-number">139756802856064</span>] AH00489: Apache/<span class="hljs-number">2.4</span><span class="hljs-number">.46</span> (Unix) configured <span class="hljs-comment">-- resuming normal operations</span>
[Wed <span class="hljs-type">Dec</span> <span class="hljs-number">16</span> <span class="hljs-number">13</span>:<span class="hljs-number">50</span>:<span class="hljs-number">34.184415</span> <span class="hljs-number">2020</span>] [core:<span class="hljs-keyword">notice</span>] [pid <span class="hljs-number">1</span>:tid <span class="hljs-number">139756802856064</span>] AH00094: Command <span class="hljs-type">line</span>: <span class="hljs-string">&#x27;httpd -D FOREGROUND&#x27;</span>
# 可以看到容器的httpd日志   

# 访问httpd服务
# 加 -t 查看访问数据
[root@localhost ~]# curl <span class="hljs-number">172.17</span><span class="hljs-number">.0</span><span class="hljs-number">.2</span>
&lt;html&gt;&lt;body&gt;&lt;h1&gt;It works!&lt;/h1&gt;&lt;/body&gt;&lt;/html&gt;
[root@localhost ~]# docker logs -f web1
AH00558: httpd: Could <span class="hljs-keyword">not</span> reliably determine the <span class="hljs-keyword">server</span><span class="hljs-string">&#x27;s fully qualified domain name, using 172.17.0.2. Set the &#x27;</span>ServerNam<span class="hljs-string">e&#x27; directive globally to suppress this message</span>
<span class="hljs-string">AH00558: httpd: Could not reliably determine the server&#x27;</span>s fully qualified <span class="hljs-keyword">domain</span> <span class="hljs-type">name</span>, <span class="hljs-keyword">using</span> <span class="hljs-number">172.17</span><span class="hljs-number">.0</span><span class="hljs-number">.2</span>. <span class="hljs-keyword">Set</span> the <span class="hljs-string">&#x27;ServerName&#x27;</span> directive globally <span class="hljs-keyword">to</span> suppress this message
[Wed <span class="hljs-type">Dec</span> <span class="hljs-number">16</span> <span class="hljs-number">13</span>:<span class="hljs-number">50</span>:<span class="hljs-number">34.114666</span> <span class="hljs-number">2020</span>] [mpm_event:<span class="hljs-keyword">notice</span>] [pid <span class="hljs-number">1</span>:tid <span class="hljs-number">139756802856064</span>] AH00489: Apache/<span class="hljs-number">2.4</span><span class="hljs-number">.46</span> (Unix) configured <span class="hljs-comment">-- resuming normal operations</span>
[Wed <span class="hljs-type">Dec</span> <span class="hljs-number">16</span> <span class="hljs-number">13</span>:<span class="hljs-number">50</span>:<span class="hljs-number">34.184415</span> <span class="hljs-number">2020</span>] [core:<span class="hljs-keyword">notice</span>] [pid <span class="hljs-number">1</span>:tid <span class="hljs-number">139756802856064</span>] AH00094: Command <span class="hljs-type">line</span>: <span class="hljs-string">&#x27;httpd -D FOREGROUND&#x27;</span>
<span class="hljs-number">172.17</span><span class="hljs-number">.0</span><span class="hljs-number">.1</span> - - [<span class="hljs-number">16</span>/<span class="hljs-type">Dec</span>/<span class="hljs-number">2020</span>:<span class="hljs-number">13</span>:<span class="hljs-number">51</span>:<span class="hljs-number">50</span> +<span class="hljs-number">0000</span>] &quot;GET / HTTP/1.1&quot; <span class="hljs-number">200</span> <span class="hljs-number">45</span>
</code></pre></li>
<li><p>容器将日志发送到stdout、stderr是docker默认的日志行为</p>
</li>
<li><p>实际上docker提供了多种多样的日志机制帮助用户从运行容器到提取日志，此过程为logging driver</p>
<blockquote>
<p>查看日志的存储地址</p>
</blockquote>
<pre><code class="hljs llvm"> [root<span class="hljs-title">@localhost</span> ~]# docker inspect web<span class="hljs-number">1</span>

 <span class="hljs-string">&quot;LogPath&quot;</span>: <span class="hljs-string">&quot;/var/lib/docker/containers/1d66f6cb4689852c41d4160a0ce4c830dec8791a2ea0b661f15d81696ea29147/1d66f6cb4689852c41d4160a0ce4c830dec8791a2ea0b661f15d81696ea29147-json.log&quot;</span>,



 # 进入到日志目录中
 [root<span class="hljs-title">@localhost</span> ~]# cd /var/lib/docker/containers/
[root<span class="hljs-title">@localhost</span> containers]# ls
<span class="hljs-number">1</span>d<span class="hljs-number">66</span>f<span class="hljs-number">6</span>cb<span class="hljs-number">4689852</span><span class="hljs-keyword">c</span><span class="hljs-number">41</span>d<span class="hljs-number">4160</span>a<span class="hljs-number">0</span>ce<span class="hljs-number">4</span><span class="hljs-keyword">c</span><span class="hljs-number">830</span>dec<span class="hljs-number">8791</span>a<span class="hljs-number">2</span>ea<span class="hljs-number">0</span>b<span class="hljs-number">661</span>f<span class="hljs-number">15</span>d<span class="hljs-number">81696</span>ea<span class="hljs-number">29147</span>

[root<span class="hljs-title">@localhost</span> containers]# cd <span class="hljs-number">1</span>d<span class="hljs-number">66</span>f<span class="hljs-number">6</span>cb<span class="hljs-number">4689852</span><span class="hljs-keyword">c</span><span class="hljs-number">41</span>d<span class="hljs-number">4160</span>a<span class="hljs-number">0</span>ce<span class="hljs-number">4</span><span class="hljs-keyword">c</span><span class="hljs-number">830</span>dec<span class="hljs-number">8791</span>a<span class="hljs-number">2</span>ea<span class="hljs-number">0</span>b<span class="hljs-number">661</span>f<span class="hljs-number">15</span>d<span class="hljs-number">81696</span>ea<span class="hljs-number">29147</span>/
[root<span class="hljs-title">@localhost</span> <span class="hljs-number">1</span>d<span class="hljs-number">66</span>f<span class="hljs-number">6</span>cb<span class="hljs-number">4689852</span><span class="hljs-keyword">c</span><span class="hljs-number">41</span>d<span class="hljs-number">4160</span>a<span class="hljs-number">0</span>ce<span class="hljs-number">4</span><span class="hljs-keyword">c</span><span class="hljs-number">830</span>dec<span class="hljs-number">8791</span>a<span class="hljs-number">2</span>ea<span class="hljs-number">0</span>b<span class="hljs-number">661</span>f<span class="hljs-number">15</span>d<span class="hljs-number">81696</span>ea<span class="hljs-number">29147</span>]# ls

<span class="hljs-number">1</span>d<span class="hljs-number">66</span>f<span class="hljs-number">6</span>cb<span class="hljs-number">4689852</span><span class="hljs-keyword">c</span><span class="hljs-number">41</span>d<span class="hljs-number">4160</span>a<span class="hljs-number">0</span>ce<span class="hljs-number">4</span><span class="hljs-keyword">c</span><span class="hljs-number">830</span>dec<span class="hljs-number">8791</span>a<span class="hljs-number">2</span>ea<span class="hljs-number">0</span>b<span class="hljs-number">661</span>f<span class="hljs-number">15</span>d<span class="hljs-number">81696</span>ea<span class="hljs-number">29147</span>-json.log
checkpoints
config.v<span class="hljs-number">2</span>.json
hostconfig.json
hostname
hosts
mounts
resolv.conf
resolv.conf.hash

[root<span class="hljs-title">@localhost</span> <span class="hljs-number">1</span>d<span class="hljs-number">66</span>f<span class="hljs-number">6</span>cb<span class="hljs-number">4689852</span><span class="hljs-keyword">c</span><span class="hljs-number">41</span>d<span class="hljs-number">4160</span>a<span class="hljs-number">0</span>ce<span class="hljs-number">4</span><span class="hljs-keyword">c</span><span class="hljs-number">830</span>dec<span class="hljs-number">8791</span>a<span class="hljs-number">2</span>ea<span class="hljs-number">0</span>b<span class="hljs-number">661</span>f<span class="hljs-number">15</span>d<span class="hljs-number">81696</span>ea<span class="hljs-number">29147</span>]# cat <span class="hljs-number">1</span>d<span class="hljs-number">66</span>f<span class="hljs-number">6</span>cb<span class="hljs-number">4689852</span><span class="hljs-keyword">c</span><span class="hljs-number">41</span>d<span class="hljs-number">4160</span>a<span class="hljs-number">0</span>ce<span class="hljs-number">4</span><span class="hljs-keyword">c</span><span class="hljs-number">830</span>dec<span class="hljs-number">8791</span>a<span class="hljs-number">2</span>ea<span class="hljs-number">0</span>b<span class="hljs-number">661</span>f<span class="hljs-number">15</span>d<span class="hljs-number">81696</span>ea<span class="hljs-number">29147</span>-json.log 
&#123;<span class="hljs-string">&quot;log&quot;</span>:<span class="hljs-string">&quot;AH00558: httpd: Could not reliably determine the server&#x27;s fully qualified domain name, using 172.17.0.2. Set the &#x27;ServerName&#x27; directive globally to suppress this message\r\n&quot;</span>,<span class="hljs-string">&quot;stream&quot;</span>:<span class="hljs-string">&quot;stdout&quot;</span>,<span class="hljs-string">&quot;time&quot;</span>:<span class="hljs-string">&quot;2020-12-16T13:50:34.090352695Z&quot;</span>&#125;
&#123;<span class="hljs-string">&quot;log&quot;</span>:<span class="hljs-string">&quot;AH00558: httpd: Could not reliably determine the server&#x27;s fully qualified domain name, using 172.17.0.2. Set the &#x27;ServerName&#x27; directive globally to suppress this message\r\n&quot;</span>,<span class="hljs-string">&quot;stream&quot;</span>:<span class="hljs-string">&quot;stdout&quot;</span>,<span class="hljs-string">&quot;time&quot;</span>:<span class="hljs-string">&quot;2020-12-16T13:50:34.133440171Z&quot;</span>&#125;
&#123;<span class="hljs-string">&quot;log&quot;</span>:<span class="hljs-string">&quot;[Wed Dec 16 13:50:34.114666 2020] [mpm_event:notice] [pid 1:tid 139756802856064] AH00489: Apache/2.4.46 (Unix) configured -- resuming normal operations\r\n&quot;</span>,<span class="hljs-string">&quot;stream&quot;</span>:<span class="hljs-string">&quot;stdout&quot;</span>,<span class="hljs-string">&quot;time&quot;</span>:<span class="hljs-string">&quot;2020-12-16T13:50:34.184523557Z&quot;</span>&#125;
&#123;<span class="hljs-string">&quot;log&quot;</span>:<span class="hljs-string">&quot;[Wed Dec 16 13:50:34.184415 2020] [core:notice] [pid 1:tid 139756802856064] AH00094: Command line: &#x27;httpd -D FOREGROUND&#x27;\r\n&quot;</span>,<span class="hljs-string">&quot;stream&quot;</span>:<span class="hljs-string">&quot;stdout&quot;</span>,<span class="hljs-string">&quot;time&quot;</span>:<span class="hljs-string">&quot;2020-12-16T13:50:34.184542089Z&quot;</span>&#125;
&#123;<span class="hljs-string">&quot;log&quot;</span>:<span class="hljs-string">&quot;172.17.0.1 - - [16/Dec/2020:13:51:50 +0000] \&quot;GET / HTTP/1.1\&quot; 200 45\r\n&quot;</span>,<span class="hljs-string">&quot;stream&quot;</span>:<span class="hljs-string">&quot;stdout&quot;</span>,<span class="hljs-string">&quot;time&quot;</span>:<span class="hljs-string">&quot;2020-12-16T13:51:50.139992282Z&quot;</span>&#125;

# 可以看到httpd的日志数据</code></pre>

</li>
</ul>
<h2 id="日志管理"><a href="#日志管理" class="headerlink" title="日志管理"></a>日志管理</h2><ul>
<li>linux日志是开源的，每种linux的日志格式是不同的 需要elk日志分析工具</li>
<li>大多数日志存放路径在 /var/log内<table>
<thead>
<tr>
<th>/var/log内的日志文件</th>
<th>解释</th>
</tr>
</thead>
<tbody><tr>
<td>boot.log</td>
<td>记录系统在引导过程中发生的事件(linux系统在开机自检中产生的信息)</td>
</tr>
<tr>
<td>messages</td>
<td>记录linux操作系统中常见的系统和服务错误日志</td>
</tr>
<tr>
<td>cron</td>
<td>记录计算机当中计划任务产生的日志</td>
</tr>
<tr>
<td>dmesg</td>
<td>记录计算机引导过程中产生的日志</td>
</tr>
<tr>
<td>mailog</td>
<td>记录电子邮件的活动信息</td>
</tr>
<tr>
<td>lastlog</td>
<td>激素计算机用户最后一次登录的时间 ip等</td>
</tr>
<tr>
<td>secure</td>
<td>加密的 linux系统安全日志，记录用户的工作组变化情况，用户登录，认证，与用户相关的信息日志</td>
</tr>
<tr>
<td>syslog</td>
<td>警告日志</td>
</tr>
<tr>
<td>stmp</td>
<td>记录用户登录，注销，系统的启动信息</td>
</tr>
</tbody></table>
</li>
</ul>
<h2 id="系统日志-syslogd服务"><a href="#系统日志-syslogd服务" class="headerlink" title="系统日志 syslogd服务"></a>系统日志 syslogd服务</h2><ul>
<li><p>配置文件<br><code>/etc/rsyslog.conf</code></p>
</li>
<li><p>配置文件格式 语法</p>
<blockquote>
<p>服务名.日志级别  动作  保存路径<br> 时间 主机名 子系统名称/程序名 消息具体内容</p>
</blockquote>
<blockquote>
<p>配置文件内的程序服务解释</p>
</blockquote>
<table>
<thead>
<tr>
<th>服务名</th>
<th>解释</th>
</tr>
</thead>
<tbody><tr>
<td>auth</td>
<td>认证相关：权限</td>
</tr>
<tr>
<td>authpriv</td>
<td>权限授权相关 PAM模块 远程等</td>
</tr>
<tr>
<td>cron</td>
<td>计划任务</td>
</tr>
<tr>
<td>daemon</td>
<td>守护进程（后台运行的程序）</td>
</tr>
<tr>
<td>kem</td>
<td>内核相关</td>
</tr>
<tr>
<td>lpr</td>
<td>打印机相关 ： 打印池</td>
</tr>
<tr>
<td>mail</td>
<td>邮件相关 本地邮件</td>
</tr>
<tr>
<td>mark</td>
<td>标记相关 防火墙网络标识</td>
</tr>
<tr>
<td>news</td>
<td>新闻相关</td>
</tr>
<tr>
<td>security</td>
<td>安全相关与auth类似：触发与更改</td>
</tr>
<tr>
<td>user</td>
<td>用户和组</td>
</tr>
<tr>
<td>uucp</td>
<td>unix to unix cp相关 isp</td>
</tr>
<tr>
<td>local0-7</td>
<td>用户自定义的</td>
</tr>
<tr>
<td>*</td>
<td>表示所有的</td>
</tr>
</tbody></table>
<blockquote>
<p>日志级别</p>
</blockquote>
<table>
<thead>
<tr>
<th>级别</th>
<th>信息</th>
<th>解释</th>
</tr>
</thead>
<tbody><tr>
<td>8</td>
<td>none</td>
<td>不记录任何日志</td>
</tr>
<tr>
<td>7</td>
<td>debug</td>
<td>记录程序/系统调试信息</td>
</tr>
<tr>
<td>6</td>
<td>info</td>
<td>记录一般信息</td>
</tr>
<tr>
<td>5</td>
<td>notice</td>
<td>记录不影响任何功能，但是需要注意的信息</td>
</tr>
<tr>
<td>4</td>
<td>warnning</td>
<td>记录可能影响功能，但是需要注意的信息 （例如apache的dns绑定）</td>
</tr>
<tr>
<td>3</td>
<td>err</td>
<td>记录允许运行但是出现错误，到时无法继续运行的信息</td>
</tr>
<tr>
<td>2</td>
<td>crit</td>
<td>记录比较严重的错误，运行中出现的错误</td>
</tr>
<tr>
<td>1</td>
<td>alert</td>
<td>记录必须马上解决的问题，系统的问题</td>
</tr>
<tr>
<td>0</td>
<td>emerg</td>
<td>记录内核/硬件错误</td>
</tr>
</tbody></table>
<blockquote>
<p>配置文件内的日志级别书写定义</p>
</blockquote>
<pre><code class="hljs routeros"> # user程序记录一般信息 输出到 /var/log/user文件下
 user.<span class="hljs-builtin-name">info</span>  /var/log<span class="hljs-built_in">/user </span>
 
 # mail程序记录一般信息 延迟输出到 /var/log/mail (延迟输入，一般是不需要立即查看日志的程序，可以降低服务器的压力)
 mail.<span class="hljs-builtin-name">info</span>  -/var/log/mail 

 # auth程序记录和info级别相等的日志信息，将日志信息以udp的形式传输到 192.168.100.212
 auth.=<span class="hljs-builtin-name">info</span> @192.168.100.212 

 # user程序只记录user不包含error的日志 以tcp的形式传输给 192.168.100.212 
 user.!=<span class="hljs-builtin-name">error</span> @@192.168.100.212 

 # user程序记录error级别以下的信息(-1) 发送给user用户
 user.!<span class="hljs-builtin-name">error</span> :<span class="hljs-built_in"> user </span>
 # user程序记录error级别以下的信息(-1) 将日志信息 转交给logrotate -f 命令来处理
 user.!<span class="hljs-builtin-name">error</span> | logrotate -f

<span class="hljs-comment">## 等等 还有好多</span>
<span class="hljs-comment"># !=  用户相关的，但不包括error的日志（只记录user不包含error的日志）</span>
<span class="hljs-comment"># ！ 记录与user的error相反的</span>
<span class="hljs-comment"># *.info   所有info级别都记录</span>
<span class="hljs-comment"># Mail.*	mail邮件的所有级别</span>
<span class="hljs-comment"># Mail的所有级别，但是不包括info级别</span></code></pre>

<h2 id="日志采集"><a href="#日志采集" class="headerlink" title="日志采集"></a>日志采集</h2><ul>
<li><p>需要把日志从一台主机传递给另外一台主机上，需要做日志处理。</p>
</li>
<li><p>计算机本身有日志处理功能</p>
</li>
<li><p>也可以改变日志的存放路径</p>
<pre><code class="hljs awk">[root@localhost ~]<span class="hljs-comment"># vim /etc/rsyslog.conf </span>
authpriv.*                                              <span class="hljs-regexp">/usr/</span>local/secure
<span class="hljs-comment"># 将 /var/log/secure日志文件 改变存储到 /usr/local/secure （57行）</span>
<span class="hljs-comment"># 重启日志管理工具</span>
[root@localhost ~]<span class="hljs-comment"># systemctl restart rsyslog</span>
<span class="hljs-comment"># 没有生成文件</span>
[root@localhost local]<span class="hljs-comment"># ls</span>
bin  etc  games  include  lib  lib64  libexec  sbin  share  src

<span class="hljs-comment"># 因为有selinux标签，需要关闭selinux才能生成</span>
[root@localhost local]<span class="hljs-comment"># setenforce 0</span>
[root@localhost local]<span class="hljs-comment"># systemctl restart rsyslog.service </span>
[root@localhost local]<span class="hljs-comment"># ls</span>
bin  etc  games  include  lib  lib64  libexec  sbin  secure  share  src

<span class="hljs-comment"># 生成日志信息</span>
[root@localhost local]<span class="hljs-comment"># su kml</span>
[kml@localhost local]$ <span class="hljs-keyword">exit</span>
<span class="hljs-keyword">exit</span>
[root@localhost local]<span class="hljs-comment"># cat secure </span>
Dec <span class="hljs-number">16</span> <span class="hljs-number">22</span>:<span class="hljs-number">44</span>:<span class="hljs-number">09</span> localhost polkitd[<span class="hljs-number">718</span>]: Registered Authentication Agent <span class="hljs-keyword">for</span> unix-process:<span class="hljs-number">67985</span>:<span class="hljs-number">340794</span> (system bus name :<span class="hljs-number">1.92</span> [<span class="hljs-regexp">/usr/</span>bin<span class="hljs-regexp">/pkttyagent --notify-fd 5 --fallback], object path /</span>org<span class="hljs-regexp">/freedesktop/</span>PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-<span class="hljs-number">8</span>)
Dec <span class="hljs-number">16</span> <span class="hljs-number">22</span>:<span class="hljs-number">44</span>:<span class="hljs-number">10</span> localhost polkitd[<span class="hljs-number">718</span>]: Unregistered Authentication Agent <span class="hljs-keyword">for</span> unix-process:<span class="hljs-number">67985</span>:<span class="hljs-number">340794</span> (system bus name :<span class="hljs-number">1.92</span>, object path <span class="hljs-regexp">/org/</span>freedesktop<span class="hljs-regexp">/PolicyKit1/</span>AuthenticationAgent, locale zh_CN.UTF-<span class="hljs-number">8</span>) (disconnected from bus)
Dec <span class="hljs-number">16</span> <span class="hljs-number">22</span>:<span class="hljs-number">44</span>:<span class="hljs-number">47</span> localhost su: pam_unix(su:session): session opened <span class="hljs-keyword">for</span> user kml by root(uid=<span class="hljs-number">0</span>)
Dec <span class="hljs-number">16</span> <span class="hljs-number">22</span>:<span class="hljs-number">44</span>:<span class="hljs-number">48</span> localhost su: pam_unix(su:session): session closed <span class="hljs-keyword">for</span> user kml

[root@localhost local]<span class="hljs-comment"># pwd</span>
<span class="hljs-regexp">/usr/</span>local

<span class="hljs-comment"># 可以看到日志信息已经能写入到这里面了</span></code></pre>
<h2 id="日志的属性权限"><a href="#日志的属性权限" class="headerlink" title="日志的属性权限"></a>日志的属性权限</h2></li>
</ul>
</li>
<li><p>也是一个隐藏权限</p>
</li>
<li><p>权限有 rwx 和 selinux标签 以及 属性权限</p>
<table>
<thead>
<tr>
<th>权限</th>
<th>解释</th>
</tr>
</thead>
<tbody><tr>
<td>A</td>
<td>time时间不能更改</td>
</tr>
<tr>
<td>S</td>
<td>数据同步写入到硬盘中</td>
</tr>
<tr>
<td>a</td>
<td>只能增加不能减少</td>
</tr>
<tr>
<td>c</td>
<td>自动将文档进行压缩</td>
</tr>
<tr>
<td>i</td>
<td>文件锁死不能做任何更改</td>
</tr>
<tr>
<td>s</td>
<td>完全移除硬盘(被删除不能恢复)</td>
</tr>
<tr>
<td>u</td>
<td>被删除后一定能恢复</td>
</tr>
<tr>
<td>d</td>
<td>dump备份</td>
</tr>
</tbody></table>
<pre><code class="hljs golo"><span class="hljs-comment"># 给 secure设置 a 权限</span>
[root<span class="hljs-meta">@localhost</span> <span class="hljs-keyword">local</span>]<span class="hljs-comment"># chattr +a /usr/local/secure </span>
<span class="hljs-comment"># 查看权限 有一个a权限</span>
[root<span class="hljs-meta">@localhost</span> <span class="hljs-keyword">local</span>]<span class="hljs-comment"># lsattr /usr/local/secure </span>
-----a---------- /usr/<span class="hljs-keyword">local</span>/secure</code></pre>

</li>
</ul>
<h2 id="日志远程传输"><a href="#日志远程传输" class="headerlink" title="日志远程传输"></a>日志远程传输</h2><table>
<thead>
<tr>
<th>主机</th>
<th>服务</th>
</tr>
</thead>
<tbody><tr>
<td>192.168.100.211</td>
<td>rsyslog</td>
</tr>
<tr>
<td>192.168.100.212</td>
<td>rsyslog</td>
</tr>
</tbody></table>
<blockquote>
<p>每台主机设置</p>
</blockquote>
<pre><code class="hljs autoit"><span class="hljs-meta"># 关闭防火墙或者放行防火墙 514端口</span>
<span class="hljs-meta"># 关闭selinux沙盒</span>
[root<span class="hljs-symbol">@localhost</span> <span class="hljs-keyword">local</span>]<span class="hljs-meta"># vim /etc/rsyslog.conf </span>
<span class="hljs-meta"># 开启udp日志转发  14行</span>
<span class="hljs-meta"># Provides UDP syslog reception</span>
$ModLoad imudp
$UDPServerRun <span class="hljs-number">514</span>
<span class="hljs-meta"># 开启tcp日志转发 18行</span>
<span class="hljs-meta"># Provides TCP syslog reception</span>
$ModLoad imtcp
$InputTCPServerRun <span class="hljs-number">514</span></code></pre>
<blockquote>
<p>192.168.100.211主机</p>
</blockquote>
 <pre><code class="hljs clean"> # <span class="hljs-number">192.168</span><span class="hljs-number">.100</span><span class="hljs-number">.211</span> 将日志信息传输到 <span class="hljs-number">192.168</span><span class="hljs-number">.100</span><span class="hljs-number">.212</span>中
 # 修改配置文件
 [root@localhost local]# vim /etc/rsyslog.conf 

 # 在 下面这个标签之内添加 
 #### RULES ####
 # 这个标签之内都是将服务的日志信息输出到特定的文件中
# 我是在<span class="hljs-number">74</span>行添加的
*.*                                                     @<span class="hljs-number">192.168</span><span class="hljs-number">.100</span><span class="hljs-number">.212</span>
# 意思是 将所有的程序的所有级别的日志都 以udp的形式传输到 <span class="hljs-number">192.168</span><span class="hljs-number">.100</span><span class="hljs-number">.212</span>主机中

</code></pre>
<blockquote>
<p>所有主机重启 服务</p>
</blockquote>
 <pre><code class="hljs autoit">[root<span class="hljs-symbol">@localhost</span> ~]<span class="hljs-meta"># systemctl restart rsyslog.service </span></code></pre>
<blockquote>
<p>192.168.100.211主机 产生日志</p>
</blockquote>
 <pre><code class="hljs autoit"><span class="hljs-meta"># 产生日志</span>
[root<span class="hljs-symbol">@localhost</span> <span class="hljs-keyword">local</span>]<span class="hljs-meta"># logger hello_lmk</span>
<span class="hljs-meta"># 只有先产生日志 192.168.100.212 才能看到日志输出</span>
</code></pre>
<blockquote>
<p>192.168.100.212主机 查看日志信息输出</p>
</blockquote>
 <pre><code class="hljs angelscript"># 查看日志信息输出
<span class="hljs-string">[root@localhost ~]</span># tail -f /var/log/messages 
# 注意 <span class="hljs-number">192.168</span><span class="hljs-number">.100</span><span class="hljs-number">.212</span>出现日志时，发送过来这才会有
Dec <span class="hljs-number">16</span> <span class="hljs-number">23</span>:<span class="hljs-number">08</span>:<span class="hljs-number">19</span> localhost root: hello_lmk
# 多出来一条</code></pre>

<h2 id="采集第三方日志-nginx日志"><a href="#采集第三方日志-nginx日志" class="headerlink" title="采集第三方日志(nginx日志)"></a>采集第三方日志(nginx日志)</h2><table>
<thead>
<tr>
<th>主机</th>
<th>服务</th>
</tr>
</thead>
<tbody><tr>
<td>192.168.100.211</td>
<td>rsyslog nginx</td>
</tr>
<tr>
<td>192.168.100.212</td>
<td>rsyslog</td>
</tr>
</tbody></table>
<blockquote>
<p>每台主机设置</p>
</blockquote>
<pre><code class="hljs autoit"><span class="hljs-meta"># 关闭防火墙或者放行防火墙 514端口</span>
<span class="hljs-meta"># 关闭selinux沙盒</span>
[root<span class="hljs-symbol">@localhost</span> <span class="hljs-keyword">local</span>]<span class="hljs-meta"># vim /etc/rsyslog.conf </span>
<span class="hljs-meta"># 开启udp日志转发  14行</span>
<span class="hljs-meta"># Provides UDP syslog reception</span>
$ModLoad imudp
$UDPServerRun <span class="hljs-number">514</span>
<span class="hljs-meta"># 开启tcp日志转发 18行</span>
<span class="hljs-meta"># Provides TCP syslog reception</span>
$ModLoad imtcp
$InputTCPServerRun <span class="hljs-number">514</span></code></pre>
<blockquote>
<p>192.168.100.211安装nginx</p>
</blockquote>
 <pre><code class="hljs autoit"> [root<span class="hljs-symbol">@localhost</span> nginx<span class="hljs-number">-1.15</span><span class="hljs-number">.4</span>]<span class="hljs-meta"># yum -y install pcre-devel openssl-devel zlib-devel </span>
 [root<span class="hljs-symbol">@localhost</span> nginx<span class="hljs-number">-1.15</span><span class="hljs-number">.4</span>]<span class="hljs-meta"># ./configure --prefix=/usr/local/nginx --user=nginx --group=nginx &amp;&amp; make &amp;&amp; make install</span>

[root<span class="hljs-symbol">@localhost</span> nginx<span class="hljs-number">-1.15</span><span class="hljs-number">.4</span>]<span class="hljs-meta"># ln -s /usr/local/nginx/sbin/* /usr/sbin/</span>
[root<span class="hljs-symbol">@localhost</span> nginx<span class="hljs-number">-1.15</span><span class="hljs-number">.4</span>]<span class="hljs-meta"># useradd -M -s /sbin/nologin nginx</span>
[root<span class="hljs-symbol">@localhost</span> nginx<span class="hljs-number">-1.15</span><span class="hljs-number">.4</span>]<span class="hljs-meta"># nginx -t </span>
nginx: the configuration file /usr/<span class="hljs-keyword">local</span>/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/<span class="hljs-keyword">local</span>/nginx/conf/nginx.conf test is successful
[root<span class="hljs-symbol">@localhost</span> nginx<span class="hljs-number">-1.15</span><span class="hljs-number">.4</span>]<span class="hljs-meta"># ls /usr/local/nginx/logs/</span>
access.<span class="hljs-built_in">log</span>  error.<span class="hljs-built_in">log</span>  nginx.pid
[root<span class="hljs-symbol">@localhost</span> nginx<span class="hljs-number">-1.15</span><span class="hljs-number">.4</span>]<span class="hljs-meta"># nginx</span>
</code></pre>
<blockquote>
<p>修改rsyslog配置文件</p>
</blockquote>
 <pre><code class="hljs awk"><span class="hljs-comment"># 添加第三方日志采集的功能模块 （13行添加）</span>
<span class="hljs-variable">$Modload</span> imfile

<span class="hljs-comment"># 在#### RULES #### 标签后添加 </span>
<span class="hljs-comment"># 我在76行添加的这些</span>
<span class="hljs-variable">$InputFilePollInterval</span> <span class="hljs-number">1</span>   <span class="hljs-comment"># 设置采集时间间隔 1s采集一次</span>
<span class="hljs-variable">$InputFileName</span> <span class="hljs-regexp">/usr/</span>local<span class="hljs-regexp">/nginx/</span>logs/access.log <span class="hljs-comment"># 设置要采集的日志目录文件</span>
<span class="hljs-variable">$InputFileTag</span> nginx-info-access; <span class="hljs-comment"># 标记日志名称 全局唯一 （可以随便写名字）</span>
<span class="hljs-variable">$InputFilestateFile</span> state-nginx-info-accesslog <span class="hljs-comment"># 标记日志上传进度 全局唯一 （可以随便写名字）</span>
<span class="hljs-variable">$InputRunFileMonitor</span> <span class="hljs-comment"># 开启监控 采集 上面文件的日志信息</span>
<span class="hljs-variable">$InputFileName</span> <span class="hljs-regexp">/usr/</span>local<span class="hljs-regexp">/nginx/</span>logs/error.log <span class="hljs-comment"># 设置要采集的日志目录文件</span>
<span class="hljs-variable">$InputFileTag</span> nginx-info-error; <span class="hljs-comment"># 标记日志名称 全局唯一 （可以随便写名字）</span>
<span class="hljs-variable">$InputFilestateFile</span> state-nginx-info-errorlog <span class="hljs-comment"># 标记日志上传进度 全局唯一 （可以随便写名字）</span>
<span class="hljs-variable">$inputRunFileMonitor</span> <span class="hljs-comment"># 开启监控 采集 上面文件的日志信息</span>
<span class="hljs-variable">$InputFilePollInterval</span> <span class="hljs-number">10</span> <span class="hljs-comment"># 定义往对端主机传输日志信息的事件间隔</span>
<span class="hljs-keyword">if</span> Sprogramname == <span class="hljs-string">&quot;nginx-info-accesslog&quot;</span> then @<span class="hljs-number">192.168</span>.<span class="hljs-number">100.212</span> <span class="hljs-comment"># 往 212网址的主机传输 nginx的access日志信息</span>
<span class="hljs-keyword">if</span> Sprogramname == <span class="hljs-string">&quot;nginx-info-accesslog&quot;</span> then ~ <span class="hljs-comment"># 这个 ~的意思是在本地也保留一份</span>
<span class="hljs-keyword">if</span> Sprogramname == <span class="hljs-string">&quot;nginx-info-errorlog&quot;</span> then @<span class="hljs-number">192.168</span>.<span class="hljs-number">100.212</span> <span class="hljs-comment"># 往 212网址的主机传输 nginx的error日志信息</span>
<span class="hljs-keyword">if</span> Sprogramname == <span class="hljs-string">&quot;nginx-info-errorlog&quot;</span> then ~ <span class="hljs-comment"># 这个 ~的意思是在本地也保留一份</span>

[root@localhost nginx-<span class="hljs-number">1.15</span>.<span class="hljs-number">4</span>]<span class="hljs-comment"># systemctl restart rsyslog # 重启rsyslog服务</span>
[root@localhost nginx-<span class="hljs-number">1.15</span>.<span class="hljs-number">4</span>]<span class="hljs-comment"># curl 192.168.100.211 # 访问nginx</span></code></pre>
<blockquote>
<p>192.168.100.212查看日志输出</p>
</blockquote>
<pre><code class="hljs angelscript"><span class="hljs-string">[root@localhost ~]</span># tail -f /var/log/messages 
# 会出现日志信息
Dec <span class="hljs-number">16</span> <span class="hljs-number">23</span>:<span class="hljs-number">35</span>:<span class="hljs-number">58</span> localhost nginx-info-access; <span class="hljs-number">192.168</span><span class="hljs-number">.100</span><span class="hljs-number">.211</span> - - [<span class="hljs-number">16</span>/Dec/<span class="hljs-number">2020</span>:<span class="hljs-number">23</span>:<span class="hljs-number">35</span>:<span class="hljs-number">54</span> +<span class="hljs-number">0800</span>] <span class="hljs-string">&quot;GET / HTTP/1.1&quot;</span> <span class="hljs-number">200</span> <span class="hljs-number">612</span> <span class="hljs-string">&quot;-&quot;</span> <span class="hljs-string">&quot;curl/7.29.0&quot;</span>
</code></pre>
<h2 id="日志切割"><a href="#日志切割" class="headerlink" title="日志切割"></a>日志切割</h2><ul>
<li><p>即日志轮滚-日志轮替</p>
</li>
<li><p>在服务器架构当中，层级越多，所产生的日志就越多，将产生的日志发送到日志服务器上（logserver），对于日志，我们需要防止文件过大，</p>
</li>
<li><p>可以通过关闭本地syslog，在logserver上对其进行切割（1G进行切割）</p>
<blockquote>
<p>查看默认可以切割的日志目录</p>
</blockquote>
<pre><code class="hljs sql">[root@localhost ~]<span class="hljs-comment"># cd /etc/logrotate.d/</span>
[root@localhost logrotate.d]<span class="hljs-comment"># ls</span>
bootlog  cups       iscsiuiolog  libvirtd.qemu  ppp     samba  syslog          yum
chrony   glusterfs  libvirtd     numad          psacct  sssd   wpa_supplicant
<span class="hljs-comment"># 这些是默认可以切割的日志信息</span>
<span class="hljs-comment"># 查看切割时使用的参数</span>
[root@localhost logrotate.d]<span class="hljs-comment"># grep -v ^# /etc/logrotate.conf | grep -v ^$</span>
Weekly		<span class="hljs-comment"># 每周切割</span>
rotate 4		<span class="hljs-comment"># 保留4个切割结果，表示最高可以查询一个月以内的日志</span>
<span class="hljs-keyword">Create</span>		<span class="hljs-comment"># 日志切割以后，在本地创建另外一个空白的日志供日志来写</span>
Dateext		<span class="hljs-comment"># 当前以日期的形式来标注切割文件的名称</span>
<span class="hljs-keyword">include</span> /etc/logrotate.d				<span class="hljs-comment"># 哪些文件遵循这个规则</span>
/<span class="hljs-keyword">var</span>/<span class="hljs-keyword">log</span>/wtmp &#123;	<span class="hljs-comment"># 	这个文件按照括号内这个标注切割</span>
    Monthly			<span class="hljs-comment"># 每个月切割一次</span>
    <span class="hljs-keyword">create</span> <span class="hljs-number">0664</span> root utmp	<span class="hljs-comment"># 创建的新文件的具体权限是多少，属组属主是多少</span>
	minsize <span class="hljs-number">1</span>M		<span class="hljs-comment"># 当我们日志大小到达1M才切割</span>
    rotate <span class="hljs-number">1</span>		 <span class="hljs-comment"># 日志切割后最多保存多少份 </span>
&#125;
/<span class="hljs-keyword">var</span>/<span class="hljs-keyword">log</span>/btmp &#123;
    Missingok		<span class="hljs-comment"># 丢失没关系</span>
    monthly <span class="hljs-comment"># # 每个月切割一次</span>
    <span class="hljs-keyword">create</span> <span class="hljs-number">0600</span> root utmp  <span class="hljs-comment"># 创建的新文件的具体权限是多少，属组属主是多少</span>
    rotate <span class="hljs-number">1</span> <span class="hljs-comment"># 日志切割后最多保存多少份 </span>
&#125;</code></pre>
</li>
<li><p>切割日志的配置参数</p>
<table>
<thead>
<tr>
<th>参数</th>
<th>解释</th>
</tr>
</thead>
<tbody><tr>
<td>Compress</td>
<td>切割之后要进行压缩</td>
</tr>
<tr>
<td>Nocompress</td>
<td>切割之后不需要进行压缩</td>
</tr>
<tr>
<td>Copytruncate</td>
<td>如果日志正在使用，先copy清空旧日志（可能会导致丢失）</td>
</tr>
<tr>
<td>Nocopytruncate</td>
<td>备份文件中不截断</td>
</tr>
<tr>
<td>create 权限 属主 属组</td>
<td>轮滚之后生成新的文件，后面跟的权限和属组属主</td>
</tr>
<tr>
<td>Nocreate</td>
<td>切割文件后不生成文件</td>
</tr>
<tr>
<td>Delaycompress</td>
<td>和compress连用，转存的日志的下一次在进行压缩</td>
</tr>
<tr>
<td>Nodelaycompress</td>
<td>轮询之后马上压缩</td>
</tr>
<tr>
<td>Missingok</td>
<td>日志切割时丢失也没关系</td>
</tr>
<tr>
<td>errors <a href="mailto:&#97;&#100;&#x64;&#x72;&#x65;&#x73;&#x73;&#64;&#x31;&#x32;&#x33;&#46;&#x63;&#x6f;&#109;">&#97;&#100;&#x64;&#x72;&#x65;&#x73;&#x73;&#64;&#x31;&#x32;&#x33;&#46;&#x63;&#x6f;&#109;</a></td>
<td>把错误信息发送个某个电子邮件</td>
</tr>
<tr>
<td>Ifempty</td>
<td>即使文件为空也轮询</td>
</tr>
<tr>
<td>Noifempty</td>
<td>日志为空则不论滚</td>
</tr>
<tr>
<td>mail <a href="mailto:&#97;&#100;&#100;&#x72;&#101;&#115;&#115;&#64;&#x31;&#50;&#51;&#46;&#x63;&#111;&#x6d;">&#97;&#100;&#100;&#x72;&#101;&#115;&#115;&#64;&#x31;&#50;&#51;&#46;&#x63;&#111;&#x6d;</a></td>
<td>把切割后的文件发送给这个文件</td>
</tr>
<tr>
<td>Nomail</td>
<td>切割后的文件在本地存储</td>
</tr>
<tr>
<td>olddir /var/log/xxxx</td>
<td>切割之后的文件存储的位置</td>
</tr>
<tr>
<td>Noolddir</td>
<td>在本地切割文件和源文件在同一个目录下，则不需要执行切割</td>
</tr>
<tr>
<td>Sharedscripts</td>
<td>后面执行某个脚本</td>
</tr>
<tr>
<td>endscript</td>
<td>脚本执行结束</td>
</tr>
<tr>
<td>Prerotate</td>
<td>切割日志之前需要做什么…</td>
</tr>
<tr>
<td>Postrotate</td>
<td>切割日志之后需要做什么…</td>
</tr>
<tr>
<td>Daily</td>
<td>每天切割</td>
</tr>
<tr>
<td>Weekly</td>
<td>每周切割</td>
</tr>
<tr>
<td>Monthly</td>
<td>每月切割</td>
</tr>
<tr>
<td>rotate 数量</td>
<td>切割之后保存多少，保存几次</td>
</tr>
<tr>
<td>Dateext</td>
<td>存储之后的文件以计算机当中日期为名字</td>
</tr>
<tr>
<td>Size或者minisize</td>
<td>最小的切割大小满足该大小之后才进行切割（例：size = 5 size 5M）</td>
</tr>
</tbody></table>
<blockquote>
<p>切割 secure日志</p>
</blockquote>
<pre><code class="hljs autoit">[root<span class="hljs-symbol">@localhost</span> ~]<span class="hljs-meta"># vi secure</span>
/var/<span class="hljs-built_in">log</span>/secure &#123;
 missingok <span class="hljs-meta"># 日志切割时丢失也没关系</span>
 notifempty <span class="hljs-meta"># 日志为空则不切割</span>
 daily <span class="hljs-meta"># 每天切割</span>
 create <span class="hljs-meta"># 切割后生成新的日志文件 防止日志没法添加到原来的日志文件</span>
 rotate <span class="hljs-number">4</span> <span class="hljs-meta"># 保存4条切割后的文件</span>
 compress <span class="hljs-meta"># 切割之后要进行压缩</span>

&#125;
</code></pre>
<blockquote>
<p>手动进行切割(如果不手动就要等一天)</p>
</blockquote>
<pre><code class="hljs routeros">  # 先查看一下日志
[root@localhost ~]# ls /var/log/
anaconda   grubby_prune_debug  secure                vmware-vgauthsvc.log.0
audit      lastlog             speech-dispatcher     vmware-vmsvc.log
boot.log   libvirt             spooler               vmware-vmusr.log
btmp       maillog             sssd                  wpa_supplicant.log
chrony     messages            swtpm                 wtmp
cron       ntpstats            tallylog              Xorg.0.log
cups       pluto               tuned                 Xorg.0.log.old
dmesg     <span class="hljs-built_in"> ppp </span>                vmware-network.1.log  Xorg.9.log
dmesg.old  qemu-ga             vmware-network.2.log  yum.log
firewalld  rhsm                vmware-network.3.log
gdm        sa                  vmware-network.4.log
glusterfs  samba               vmware-network.log

<span class="hljs-comment"># 手动切割日志</span>
[root@localhost ~]# logrotate -vf /root/secure 
reading<span class="hljs-built_in"> config </span>file /root/secure
Allocating hash table <span class="hljs-keyword">for</span> state file, size 15360 B

Handling 1 logs
<span class="hljs-built_in">..</span><span class="hljs-built_in">..</span><span class="hljs-built_in">..</span><span class="hljs-built_in">..</span><span class="hljs-built_in">..</span><span class="hljs-built_in">..</span><span class="hljs-built_in">..</span><span class="hljs-built_in">..</span><span class="hljs-built_in">..</span><span class="hljs-built_in">..</span><span class="hljs-built_in">..</span>.
<span class="hljs-comment"># 在查看日志地址</span>
[root@localhost ~]# ls /var/log/
anaconda   grubby_prune_debug  secure                vmware-network.log
audit      lastlog             secure.1.gz           vmware-vgauthsvc.log.0
boot.log   libvirt             speech-dispatcher     vmware-vmsvc.log
btmp       maillog             spooler               vmware-vmusr.log
chrony     messages            sssd                  wpa_supplicant.log
cron       ntpstats            swtpm                 wtmp
cups       pluto               tallylog              Xorg.0.log
dmesg     <span class="hljs-built_in"> ppp </span>                tuned                 Xorg.0.log.old
dmesg.old  qemu-ga             vmware-network.1.log  Xorg.9.log
firewalld  rhsm                vmware-network.2.log  yum.log
gdm        sa                  vmware-network.3.log
glusterfs  samba               vmware-network.4.log
<span class="hljs-comment"># 多了一个secure.1.gz   </span>
</code></pre>
<ul>
<li>引发出的问题<pre><code class="hljs awk"> <span class="hljs-comment"># 但是这样会引发一个问题，用户在进行操作时，日志已经传输不到原来的secure日志文件中了 要重启服务才可以</span>
[root@localhost ~]<span class="hljs-comment"># cd /var/log</span>
[root@localhost log]<span class="hljs-comment"># cat secure</span>
[root@localhost log]<span class="hljs-comment"># su lmk</span>
[lmk@localhost log]$ <span class="hljs-keyword">exit</span>
<span class="hljs-keyword">exit</span>
[root@localhost log]<span class="hljs-comment"># cat secure</span>
<span class="hljs-comment"># 是没有写入数据的</span>

<span class="hljs-comment"># 重启服务</span>
[root@localhost log]<span class="hljs-comment"># systemctl restart rsyslog.service </span>
[root@localhost log]<span class="hljs-comment"># su lmk</span>
[lmk@localhost log]$ <span class="hljs-keyword">exit</span>
<span class="hljs-keyword">exit</span>
[root@localhost log]<span class="hljs-comment"># cat secure</span>
Dec <span class="hljs-number">17</span> <span class="hljs-number">00</span>:<span class="hljs-number">14</span>:<span class="hljs-number">41</span> localhost polkitd[<span class="hljs-number">792</span>]: Unregistered Authentication Agent <span class="hljs-keyword">for</span> unix-process:<span class="hljs-number">98236</span>:<span class="hljs-number">883928</span> (system bus name :<span class="hljs-number">1.111</span>, object path <span class="hljs-regexp">/org/</span>freedesktop<span class="hljs-regexp">/PolicyKit1/</span>AuthenticationAgent, locale zh_CN.UTF-<span class="hljs-number">8</span>) (disconnected from bus)
Dec <span class="hljs-number">17</span> <span class="hljs-number">00</span>:<span class="hljs-number">14</span>:<span class="hljs-number">49</span> localhost su: pam_unix(su:session): session opened <span class="hljs-keyword">for</span> user lmk by root(uid=<span class="hljs-number">0</span>)
Dec <span class="hljs-number">17</span> <span class="hljs-number">00</span>:<span class="hljs-number">14</span>:<span class="hljs-number">50</span> localhost su: pam_unix(su:session): session closed <span class="hljs-keyword">for</span> user lmk

<span class="hljs-comment"># 重启服务才会写入数据，所以切割文件要优化一下</span>
</code></pre>
<blockquote>
<p>新切割文件</p>
</blockquote>
<pre><code class="hljs awk">[root@localhost ~]<span class="hljs-comment"># chattr +a /var/log/secure</span>
[root@localhost ~]<span class="hljs-comment"># vi secure </span>
<span class="hljs-regexp">/var/</span>log/secure &#123;
  sharedscripts <span class="hljs-comment">#  后面执行某个脚本</span>
    prerotate <span class="hljs-comment"># 切割日志之前需要做什么...</span>
      <span class="hljs-regexp">/usr/</span>bin<span class="hljs-regexp">/chattr -a /</span>var<span class="hljs-regexp">/log/</span>secure <span class="hljs-comment"># 将这个日志文件的a属性权限删掉</span>
  endscript <span class="hljs-comment"># 脚本执行结束</span>
    missingok <span class="hljs-comment"># 日志切割时文件丢失也没关系</span>
    notifempty <span class="hljs-comment"># 日志内容为空则不切割</span>
    daily <span class="hljs-comment"># 每天切割一次</span>
    create <span class="hljs-comment"># 切割完成后创建原来的那个secure日志文件</span>
    rotate <span class="hljs-number">4</span> <span class="hljs-comment"># 切割后的文件最多保存4份</span>
    compress <span class="hljs-comment"># 切割后要进行压缩</span>
    dateext <span class="hljs-comment"># 切割后文件以计算机当中的日志为名字</span>
   sharedscripts <span class="hljs-comment"># 后面执行某个脚本</span>
    postrotate <span class="hljs-comment"># 切割日志之后需要做什么...</span>
      <span class="hljs-regexp">/bin/</span>kill -HUP `cat <span class="hljs-regexp">/var/</span>run<span class="hljs-regexp">/syslogd.pid 2&gt; /</span>dev<span class="hljs-regexp">/null` 2&gt;  /</span>dev/null <span class="hljs-comment"># 重启syslogd程序</span>
      <span class="hljs-regexp">/usr/</span>bin<span class="hljs-regexp">/chattr +a /</span>var<span class="hljs-regexp">/log/</span>secure <span class="hljs-comment"># 再给secure文件加会a属性权限</span>
   endscript  <span class="hljs-comment"># 脚本执行结束</span>
&#125;
</code></pre>
<blockquote>
<p>手动切割</p>
</blockquote>
<pre><code class="hljs pf">[root@localhost ~]<span class="hljs-comment"># logrotate -vf /root/secure </span>
reading config file /root/secure
Allocating hash <span class="hljs-built_in">table</span> <span class="hljs-keyword">for</span> <span class="hljs-keyword">state</span> file, size <span class="hljs-number">15360</span> B

Handling <span class="hljs-number">1</span> logs

rotating pattern: /var/<span class="hljs-keyword">log</span>/secure  forced <span class="hljs-keyword">from</span> command line (<span class="hljs-number">4</span> rotations)
empty <span class="hljs-keyword">log</span> files are not rotated, old logs are removed
considering <span class="hljs-keyword">log</span> /var/<span class="hljs-keyword">log</span>/secure
.........
<span class="hljs-comment"># 查看日志文件目录</span>
[root@localhost ~]<span class="hljs-comment"># ls /var/log/</span>
anaconda   grubby_prune_debug  secure                vmware-network.<span class="hljs-number">4</span>.<span class="hljs-keyword">log</span>
audit      lastlog             secure.<span class="hljs-number">1</span>.gz           vmware-network.<span class="hljs-keyword">log</span>
boot.<span class="hljs-keyword">log</span>   libvirt             secure-<span class="hljs-number">20201217</span>.gz    vmware-vgauthsvc.<span class="hljs-keyword">log</span>.<span class="hljs-number">0</span>
btmp       maillog             speech-dispatcher     vmware-vmsvc.<span class="hljs-keyword">log</span>
chrony     messages            spooler               vmware-vmusr.<span class="hljs-keyword">log</span>
cron       ntpstats            sssd                  wpa_supplicant.<span class="hljs-keyword">log</span>
cups       pluto               swtpm                 wtmp
dmesg      ppp                 tallylog              Xorg.<span class="hljs-number">0</span>.<span class="hljs-keyword">log</span>
dmesg.old  qemu-ga             tuned                 Xorg.<span class="hljs-number">0</span>.<span class="hljs-keyword">log</span>.old
firewalld  rhsm                vmware-network.<span class="hljs-number">1</span>.<span class="hljs-keyword">log</span>  Xorg.<span class="hljs-number">9</span>.<span class="hljs-keyword">log</span>
gdm        sa                  vmware-network.<span class="hljs-number">2</span>.<span class="hljs-keyword">log</span>  yum.<span class="hljs-keyword">log</span>
glusterfs  samba               vmware-network.<span class="hljs-number">3</span>.<span class="hljs-keyword">log</span>
<span class="hljs-comment"># 多出来 secure-20201217.gz   文件</span>
<span class="hljs-comment"># 而且 目录中的 secure还可以正常写入日志</span></code></pre></li>
</ul>
</li>
<li><p>接下来用任务计划把命令定时执行就ok了</p>
<pre><code class="hljs awk">[root@localhost ~]<span class="hljs-comment"># crontab -e</span>
* * * * <span class="hljs-number">1</span> <span class="hljs-regexp">/usr/</span>sbin<span class="hljs-regexp">/logrotate -vf /</span>root/secure 
<span class="hljs-comment"># 每周1切割一次</span></code></pre>

</li>
</ul>
<!-- /var/log/secure {
 sharedscripts
   prerotate
    /usr/bin/chattr -a /var/log/secure
 endscript
  missingok
  ifempty
  daily
  create
  rotate 4
  compress
  dateext
  sharedscripts
    prerotate
     /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null
     /usr/bin/chattr +a /var/log/secure
  endscript
} -->
            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/docker/">docker</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/docker/">docker</a>
                    
                  </div>
                
              </div>
              
                <p class="note note-warning">本博客所有文章是以学习为目的，如果有不对的地方可以一起交流沟通共同学习 邮箱:1248287831@qq.com！</p>
              
              
                <div class="post-prevnext row">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2020/12/15/docker-ELK%E6%97%A5%E5%BF%97%E9%87%87%E9%9B%86/">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">docker-ELK日志采集</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2020/12/15/docker-%E7%9B%91%E6%8E%A7/">
                        <span class="hidden-mobile">docker-监控</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div id="tocbot"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->


    
  </main>

  
    <a id="scroll-top-button" href="#" role="button">
      <i class="iconfont icon-arrowup" aria-hidden="true"></i>
    </a>
  

  
    <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
  

  

  <footer class="text-center mt-5 py-3">
  <div class="footer-content">
     <a href="https://space.bilibili.com/39165374" target="_blank" rel="nofollow noopener"><span>LMK</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> 
  </div>
  
  <div class="statistics">
    
    

    
      
        <!-- 不蒜子统计PV -->
        <span id="busuanzi_container_site_pv" style="display: none">
            总访问量 
            <span id="busuanzi_value_site_pv"></span>
             次
          </span>
      
      
        <!-- 不蒜子统计UV -->
        <span id="busuanzi_container_site_uv" style="display: none">
            总访客数 
            <span id="busuanzi_value_site_uv"></span>
             人
          </span>
      
    
  </div>


  

  
</footer>

<!-- SCRIPTS -->
<script  src="https://cdn.staticfile.org/jquery/3.4.1/jquery.min.js" ></script>
<script  src="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/js/bootstrap.min.js" ></script>
<script  src="/js/debouncer.js" ></script>
<script  src="/js/main.js" ></script>

<!-- Plugins -->


  
    <script  src="/js/lazyload.js" ></script>
  



  



  <script defer src="https://cdn.staticfile.org/clipboard.js/2.0.6/clipboard.min.js" ></script>
  <script  src="/js/clipboard-use.js" ></script>



  <script defer src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>





  <script  src="https://cdn.staticfile.org/tocbot/4.11.1/tocbot.min.js" ></script>
  <script>
    $(document).ready(function () {
      var boardCtn = $('#board-ctn');
      var boardTop = boardCtn.offset().top;

      tocbot.init({
        tocSelector: '#tocbot',
        contentSelector: '#post-body',
        headingSelector: 'h1,h2,h3,h4,h5,h6',
        linkClass: 'tocbot-link',
        activeLinkClass: 'tocbot-active-link',
        listClass: 'tocbot-list',
        isCollapsedClass: 'tocbot-is-collapsed',
        collapsibleClass: 'tocbot-is-collapsible',
        collapseDepth: 0,
        scrollSmooth: true,
        headingsOffset: -boardTop
      });
      if ($('.toc-list-item').length > 0) {
        $('#toc').css('visibility', 'visible');
      }
    });
  </script>



  <script  src="https://cdn.staticfile.org/typed.js/2.0.11/typed.min.js" ></script>
  <script>
    var typed = new Typed('#subtitle', {
      strings: [
        '  ',
        "docker-日志管理&nbsp;",
      ],
      cursorChar: "_",
      typeSpeed: 70,
      loop: false,
    });
    typed.stop();
    $(document).ready(function () {
      $(".typed-cursor").addClass("h2");
      typed.start();
    });
  </script>



  <script  src="https://cdn.staticfile.org/anchor-js/4.2.2/anchor.min.js" ></script>
  <script>
    anchors.options = {
      placement: "right",
      visible: "hover",
      
    };
    var el = "h1,h2,h3,h4,h5,h6".split(",");
    var res = [];
    for (item of el) {
      res.push(".markdown-body > " + item)
    }
    anchors.add(res.join(", "))
  </script>



  <script  src="/js/local-search.js" ></script>
  <script>
    var path = "/local-search.xml";
    var inputArea = document.querySelector("#local-search-input");
    inputArea.onclick = function () {
      searchFunc(path, 'local-search-input', 'local-search-result');
      this.onclick = null
    }
  </script>



  <script  src="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.css" />

  <script>
    $('#post img:not(.no-zoom img, img[no-zoom]), img[zoom]').each(
      function () {
        var element = document.createElement('a');
        $(element).attr('data-fancybox', 'images');
        $(element).attr('href', $(this).attr('src'));
        $(this).wrap(element);
      }
    );
  </script>















</body>
</html>
